小黑，我教的CNCG的作业!! (6千字)
Fast Browser 4.03破解过程过程：
首先用language查到该软件是由pecompact加的壳，干掉他！
简单！用冲击波+TRW就搞定了！
由于该软件需要上网校验用户名和注册码，所以要先把这个功能干掉
所以用W32DASM查找："Connect to the Internet now so "
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004DB763(C)
|
:004DB77F A100645000 mov eax, dword ptr [00506400]
:004DB784 803800 cmp byte ptr [eax], 00
:004DB787 751C jne 004DB7A5
:004DB789 B811000000 mov eax, 00000011
:004DB78E E8D9BBFCFF call 004A736C
:004DB793 84C0 test al, al
:004DB795 741A je 004DB7B1－－－－－这里NOP掉
:004DB797 B810000000 mov eax, 00000010
:004DB79C E8CBBBFCFF call 004A736C
:004DB7A1 84C0 test al, al
:004DB7A3 740C je 004DB7B1－－－－－这里NOP掉
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004DB787(C)
|
:004DB7A5 8BC3 mov eax, ebx
:004DB7A7 E818FDFFFF call 004DB4C4－－－－跟进这个CALL看看
:004DB7AC E904010000 jmp 004DB8B5
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004DB795(C), :004DB7A3(C)
|
:004DB7B1 8D45FC lea eax, dword ptr [ebp-04]
* Possible StringData Ref from Code Obj ->"Connect to the Internet now so "－－－－－向上看
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－call 004DB4C4：
进入后我们停到这里：
* Referenced by a CALL at Addresses:
|:004DB7A7 , :004DBDAF
|
:004DB4C4 55 push ebp
:004DB4C5 8BEC mov ebp, esp
:004DB4C7 B906000000 mov ecx, 00000006
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004DB4D1(C)
|
:004DB4CC 6A00 push 00000000
:004DB4CE 6A00 push 00000000
:004DB4D0 49 dec ecx
:004DB4D1 75F9 jne 004DB4CC
:004DB4D3 51 push ecx
:004DB4D4 53 push ebx
:004DB4D5 8BD8 mov ebx, eax
:004DB4D7 33C0 xor eax, eax
:004DB4D9 55 push ebp
:004DB4DA 68D7B64D00 push 004DB6D7
:004DB4DF 64FF30 push dword ptr fs:[eax]
:004DB4E2 648920 mov dword ptr fs:[eax], esp
:004DB4E5 A100645000 mov eax, dword ptr [00506400]
:004DB4EA 803800 cmp byte ptr [eax], 00
:004DB4ED 752B jne 004DB51A
:004DB4EF 8D55FC lea edx, dword ptr [ebp-04]
:004DB4F2 8B83F4020000 mov eax, dword ptr [ebx+000002F4]
:004DB4F8 E8EB9BF5FF call 004350E8
:004DB4FD 8B45FC mov eax, dword ptr [ebp-04]
:004DB500 50 push eax
:004DB501 8D55F8 lea edx, dword ptr [ebp-08]
:004DB504 8B83F8020000 mov eax, dword ptr [ebx+000002F8]
:004DB50A E8D99BF5FF call 004350E8
:004DB50F 8B45F8 mov eax, dword ptr [ebp-08]
:004DB512 5A pop edx
:004DB513 E8C895FFFF call 004D4AE0 ---------再跟进这个CALL，不要问为什么，我蒙的
:004DB518 EB29 jmp 004DB543
-------------------------------------------------------------------------------------------------
跟进call 004d4ae0后：
直觉是蒙对了（其实是试的！＾O＾）
* Referenced by a CALL at Addresses:
|:004D514A , :004DB513
|
:004D4AE0 55 push ebp
:004D4AE1 8BEC mov ebp, esp
:004D4AE3 83C4F4 add esp, FFFFFFF4
:004D4AE6 53 push ebx
:004D4AE7 33C9 xor ecx, ecx
:004D4AE9 894DF4 mov dword ptr [ebp-0C], ecx
:004D4AEC 8955F8 mov dword ptr [ebp-08], edx
:004D4AEF 8945FC mov dword ptr [ebp-04], eax
:004D4AF2 8B45FC mov eax, dword ptr [ebp-04]
:004D4AF5 E8AAF6F2FF call 004041A4
:004D4AFA 8B45F8 mov eax, dword ptr [ebp-08]
:004D4AFD E8A2F6F2FF call 004041A4
:004D4B02 33C0 xor eax, eax
:004D4B04 55 push ebp
:004D4B05 68A74B4D00 push 004D4BA7
:004D4B0A 64FF30 push dword ptr fs:[eax]
:004D4B0D 648920 mov dword ptr fs:[eax], esp
:004D4B10 837DFC00 cmp dword ptr [ebp-04], 00000000
:004D4B14 741E je 004D4B34
:004D4B16 837DF800 cmp dword ptr [ebp-08], 00000000
:004D4B1A 7418 je 004D4B34
:004D4B1C 8D55F4 lea edx, dword ptr [ebp-0C]
:004D4B1F 8B45FC mov eax, dword ptr [ebp-04]
:004D4B22 E8D1FEFFFF call 004D49F8---这里一大堆乱七八糟的，好像是算法，俺不懂（~_~）
:004D4B27 8B55F4 mov edx, dword ptr [ebp-0C]－－这里是真码
:004D4B2A 8B45F8 mov eax, dword ptr [ebp-08]－－这里是假码
:004D4B2D E8CEF5F2FF call 00404100------------------这里是比较(记下，一会做注册机)
:004D4B32 7404 je 004D4B38-------------------相等就万事OK了!!!!!
-------------------------------------------------------------------------------------------------
进入CALL 00404100比较CALL后：
:00404100 53 push ebx
:00404101 56 push esi
:00404102 57 push edi
:00404103 89C6 mov esi, eax
:00404105 89D7 mov edi, edx
:00404107 39D0 cmp eax, edx ----关键比较!(记下一会儿做注册机)
:00404109 0F848F000000 je 0040419E
:0040410F 85F6 test esi, esi
:00404111 7468 je 0040417B
:00404113 85FF test edi, edi
:00404115 746B je 00404182
:00404117 8B46FC mov eax, dword ptr [esi-04]
:0040411A 8B57FC mov edx, dword ptr [edi-04]
:0040411D 29D0 sub eax, edx
:0040411F 7702 ja 00404123
:00404121 01C2 add edx, eax
用刘健英大侠编的注册机制作起来真的好方便!(非常感谢刘大侠!)
打开keymake后按F8进入制作另类注册机!
添加刚刚要记下的两个地方
分别是：中断地址 中断次数 第一字节 字节长度
4D4B2D 1 E8 5
404107 1 39 2
添加完毕后生成!运行注册机文件，自动带起FAST BROWSER在注册对话框中随便填入注册码，拦截成功!!!爽!
总结：
用户名：lllufh[BCG][CNCG]
注册码：31787131761427888
